Github.Com Grafana Grafana vulnerabilities

CVE-2022-39201 [HIGH] CWE-200 Grafana Data source and plugin proxy endpoints could leak the authentication cookie to some destination plugins Grafana Data source and plugin proxy endpoints could leak the authentication cookie to some destination plugins Today we are releasing Grafana 9.2. Alongside with new features and other bug fixes, this release includes a Moderate severity security fix for CVE-2022-39201 We are also releasing security patches for Grafana 9.1.8 and Grafana 8.5.14 to fix th

CVE-2022-39306 [HIGH] CWE-20 Grafana Email addresses and usernames can not be trusted Grafana Email addresses and usernames can not be trusted Today we are releasing Grafana 9.2.4. Alongside other bug fixes, this patch release includes moderate severity security fixes for CVE-2022-39306. We are also releasing security patches for Grafana 8.5.15 to fix these issues. Release 9.2.4, latest patch, also containing security fix: - [Download Grafana 9.2.4](https://grafana.com/grafana/download/9.2.4

CVE-2021-41244 [CRITICAL] CWE-610 Grafana Fine-grained access control vulnerability Grafana Fine-grained access control vulnerability ### Impact On Nov. 2, during an internal security audit, we discovered that when the fine-grained access control beta feature is enabled and there is more than one organization in the Grafana instance, Grafana 8.0 introduced a mechanism which allowed users with the Organization Admin role to list, add, remove, and update users’ roles in other organizations in whi

CVE-2026-27877 [MEDIUM] CWE-200 Grafana public dashboards disclose all direct mode datasources Grafana public dashboards disclose all direct mode datasources When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards. No passwords of proxied data-sources are exposed. We encourage all direct data-sources to be converted to proxied data-sources as far as possible to improve your deployments' security.

CVE-2026-33380 [MEDIUM] CWE-552 Grafana: SQL Expressions Read File From Disk Grafana: SQL Expressions Read File From Disk A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the Grafana server's filesystem. Only instances with the sqlExpressions feature toggle enabled are vulnerable.

CVE-2019-19499 [MEDIUM] CWE-200 Grafana Arbitrary File Read Grafana Arbitrary File Read Grafana <= 6.4.3 has an Arbitrary File Read vulnerability, which could be exploited by an authenticated attacker that has privileges to modify the data source configurations.

CVE-2023-4822 [MEDIUM] CWE-269 Grafana privilege escalation vulnerability Grafana privilege escalation vulnerability Grafana is an open-source platform for monitoring and observability. The vulnerability impacts instances with several organizations, and allows a user with Organization Admin permissions in one organization to change the permissions associated with Organization Viewer, Organization Editor and Organization Admin roles in all organizations. It also allows an Organization Admin to

CVE-2024-1313 [HIGH] CWE-639 Grafana: Users outside an organization can delete a snapshot with its key Grafana: Users outside an organization can delete a snapshot with its key ### Summary The ***DELETE /api/snapshots/{key}*** endpoint allows any Grafana user to delete snapshots if the user is NOT in the organization of the snapshot ### Details An attacker (a user without organization affiliation or with a "no basic role" in an organization other than the one where the dashboard exists), know

CVE-2022-35957 [MEDIUM] CWE-290 Grafana Escalation from admin to server admin when auth proxy is used Grafana Escalation from admin to server admin when auth proxy is used Today we are releasing Grafana 9.1.6, 9.0.9, 8.5.13. This patch release includes a Moderate severity security fix for CVE-2022-35957 that affects Grafana instances which are using Grafana [Auth Proxy](https://grafana.com/docs/grafana/latest/setup-grafana/configure-security/configure-authentication/auth-proxy/#configure-auth-p

CVE-2022-31123 [HIGH] CWE-347 Grafana Plugin signature bypass Grafana Plugin signature bypass Today we are releasing Grafana 9.2. Alongside with new features and other bug fixes, this release includes a Moderate severity security fix for CVE-2022-31123 We are also releasing security patches for Grafana 9.1.8 and Grafana 8.5.14 to fix these issues. Release 9.2, latest release, also containing security fix: - [Download Grafana 9.2](https://grafana.com/grafana/download/9.2) Release 9.1.8, only

CVE-2023-0507 [MEDIUM] CWE-79 Grafana vulnerable to Cross-site Scripting Grafana vulnerable to Cross-site Scripting Grafana is an open-source platform for monitoring and observability. Starting with the 8.1 branch, Grafana had a stored XSS vulnerability affecting the core plugin GeoMap. The stored XSS vulnerability was possible due to map attributions weren't properly sanitized and allowed arbitrary JavaScript to be executed in the context of the currently authorized user of the Grafana instanc

CVE-2023-2183 [MEDIUM] CWE-284 Grafana has Broken Access Control in Alert manager: Viewer can send test alerts Grafana has Broken Access Control in Alert manager: Viewer can send test alerts ### Summary Grafana allows an attacker in the Viewer role, send alerts by API Alert - Test. The option is not available from the user panel UI for in the Viewer role. **Reason for the error**: The API does not check access to this function and allows it by users with the least rights, for example, the View

CVE-2023-0594 [MEDIUM] CWE-79 Grafana vulnerable to Cross-site Scripting Grafana vulnerable to Cross-site Scripting Grafana is an open-source platform for monitoring and observability. Starting with the 7.0 branch, Grafana had a stored XSS vulnerability in the trace view visualization. The stored XSS vulnerability was possible due the value of a span's attributes/resources were not properly sanitized and this will be rendered when the span's attributes/resources are expanded. An attacker needs

CVE-2022-21702 [MEDIUM] CWE-79 Grafana proxy Cross-site Scripting Grafana proxy Cross-site Scripting Today we are releasing Grafana 8.3.5 and 7.5.15. This patch release includes MEDIUM severity security fix for XSS for Grafana. Release v.8.3.5, only containing security fixes: - [Download Grafana 8.3.5](https://grafana.com/grafana/download/8.3.5) - [Release notes](https://grafana.com/docs/grafana/latest/release-notes/release-notes-8-3-5/) Release v.7.5.15, only containing security fixes: - [

CVE-2021-43815 [HIGH] CWE-22 Grafana directory traversal for .cvs files Grafana directory traversal for .cvs files Today we are releasing Grafana `8.3.2` and `7.5.12`. This patch release includes a moderate severity security fix for directory traversal for arbitrary `.csv` files. It only affects instances that have the developer testing tool called [TestData DB data source](https://grafana.com/docs/grafana/latest/datasources/testdata/) enabled and configured. The vulnerability is limited in sc

CVE-2025-41117 [MEDIUM] CWE-79 Grafana has a Cross-site Scripting issue Grafana has a Cross-site Scripting issue Stack traces in Grafana's Explore Traces view can be rendered as raw HTML, and thus inject malicious JavaScript in the browser. This would require malicious JavaScript to be entered into the stack trace field. Only datasources with the Jaeger HTTP API appear to be affected; Jaeger gRPC and Tempo do not appear affected whatsoever.

CVE-2025-3454 [MEDIUM] CWE-285 Grafana's datasource proxy API allows authorization checks to be bypassed Grafana's datasource proxy API allows authorization checks to be bypassed This vulnerability in Grafana's datasource proxy API allows authorization checks to be bypassed by adding an extra slash character in the URL path. Users with minimal permissions could gain unauthorized read access to GET endpoints in Alertmanager and Prometheus datasources. The issue primarily affects datasources th

CVE-2023-22462 [MEDIUM] CWE-79 Grafana vulnerable to Stored Cross-site Scripting in Text plugin Grafana vulnerable to Stored Cross-site Scripting in Text plugin ### Description On 2023-01-01 during an internal audit of Grafana, a member of the security team found a stored XSS vulnerability affecting the core plugin "Text". The stored XSS vulnerability requires several user interactions in order to be fully exploited. The vulnerability was possible due to React's render cycle that will pass tho

CVE-2023-2801 [HIGH] CWE-662 Grafana Missing Synchronization vulnerability Grafana Missing Synchronization vulnerability Grafana is an open-source platform for monitoring and observability. Using public dashboards users can query multiple distinct data sources using mixed queries. However such query has a possibility of crashing a Grafana instance. The only feature that uses mixed queries at the moment is public dashboards, but it's also possible to cause this by calling the query API directl

CVE-2024-6322 [MEDIUM] CWE-266 Grafana plugin data sources vulnerable to access control bypass Grafana plugin data sources vulnerable to access control bypass Access control for plugin data sources protected by the ReqActions json field of the plugin.json is bypassed if the user or service account is granted associated access to any other data source, as the ReqActions check was not scoped to each specific datasource. The account must have prior query access to the impacted datasource.